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In air traffic management, conflict prevention information refers to the guidance ma- 
neuvers, which if taken, ensure that an aircraft’s path is conflict-free. These guidance 
maneuvers take the form of changes to track angle or ground speed. Conflict prevention 
information may be assembled into prevention bands that advise the crew on maneuvers 
that should not be taken. Unlike conflict resolution systems, which presume that the 
aircraft already has a conflict, conflict prevention systems show conflicts for any maneu- 
ver, giving the pilot confidence that if a maneuver is made, then no near-term conflicts 
will result. Because near-term conflicts can lead to safety concerns, strong verification 
of information correctness is required. This paper presents a mathematical framework to 
analyze the correctness of algorithms that produce conflict prevention information incorpo- 
rating an arbitrary number of traffic aircraft and with both a near-term and intermediate- 
term lookahead times. The framework is illustrated with a formally verified algorithm for 
2-dimensional track angle prevention bands. 


Nomenclature 
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set of track angle bands without a loss of separation within time T re d , but within time T am ber 

set of track angle bands without a loss of separation within time T am ber 

set of track angle bands with a loss of separation within time T re d 
set of track angles with a loss of separation within time T 

set of track angles with a loss of separation within T between the ownship and traffic aircraft 

ownship aircraft position relative to the traffic aircraft, s = s G — Sj 

initial position of the traffic aircraft 

initial position of the ownship aircraft 

intermediate-term lookahead time 

near-term lookahead time 

generic lookahead time 

initial velocity of the traffic aircraft 

initial velocity of the ownship aircraft 

new velocity vector for the ownship. We seek this vector. 


I. Introduction 

Different types of information are used to help aircraft maintain separation standards. At the lowest 
level, information is needed to indicate if separation standards will be violated in the near future — called a 
conflict Once a conflict is detected, then conflict resolution information may be used to create a new path 
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in which there is no conflict. Most future airspace concepts propose using computer algorithms to produce 
this information. Both conflict detection and resolution algorithms usually work in a pair-wise fashion: the 
ownship aircraft and one other aircraft. In situations where traffic density is low, this pair-wise assumption 
does not significantly impact operations. However, when traffic density is high, resolving one conflict may 
result in new near-term conflicts — called secondary conflicts. These secondary conflicts may be nearer (in 
time) than the original conflict being addressed; so, the safety of the aircraft depends on avoiding these 
conflicts. More generally, any time an aircraft maneuvers there is the potential to create new conflicts, which 
must be avoided both for safety and efficiency. 

Information to avoid potential conflicts involves analyzing possible ma- 
neuvers of the aircraft. There are two basic approaches to tactical 3 air- 
borne conflict prevention: probing and bands. In the maneuver probing 
approach, the pilot or controller provides an individual maneuver, which 
is tested to ensure the proposed trajectory is conflict-free. In the bands 
approach, large groups of possible maneuvers are analyzed and the pilot 
is presented with ranges of track angles or ground speeds, which, if taken, 
will result in conflict-free trajectories. Alternatively, these ranges could 
represent avoidance or “don’t go” zones. These ranges of guidance ma- 
neuvers are referred to as conflict- prevention information. The National 
Aerospace Laboratory (NLR) refers to their conflict prevention capability 
as Predictive Airborne Separation Assurance System or Predictive AS AS. 3 
The NLR approach provides two sets of bands: near-term conflicts (within 
3 minutes) are shown in red, while intermediate-term conflicts (within 5 
minutes) are shown in amber as illustrated in figure 1. We do not di- 
rectly analyze the NLR system, but we do use it to characterize input 
and output information from a typical conflict prevention system. 

Conflict prevention information may be presented directly to a pilot 
or controller or it may be supplied to another automated system. In either case, since aircraft safety may be 
threatened by incorrect conflict prevention information, a rigorous analysis of this information is needed. This 
paper provides this analysis. As with all such analysis, certain assumptions are made including ignoring the 
impact of aircraft performance, weather, or special use airspace; planned future work involves relaxing these 
assumptions. The correctness of this information is established through a mathematical characterization and 
analysis of the conflict-free regions for ground speed and track angles changes. The theory presented in this 
paper has been formalized and verified in the Prototype Verification System (PVS) 6 and is publicly available. b 
In this paper, we use standard mathematical notation make the paper accessible to a wider audience. To 
illustrate the general mathematical framework for the analysis of conflict prevention information, we present 
a 2-dimensional algorithm for track angle prevention bands. For completeness, a 2-dimensional algorithm for 
ground speed preventions bands is presented in the appendix. Both algorithms have been formally verified 
correct. We are currently working on candidate algorithms for 3-dimensional prevention bands. 5 

Although conflict-prevention systems have been used in several human-in-the-loop simulation experi- 
ments 1 2 ’ 2,4 and their functionality has been described in other papers, 3,7 we believe this is the first published 
analysis of such information. The primary focus of this work is conflict-prevention systems for airborne 
operation, but there is nothing inherent in this approach which precludes use in ground-based systems. 

II. Problem Assessment 

In this section, we analyze conflict prevention information to discover its essential elements, then we show 
how these essential elements may be analyzed mathematically for safety. Conflict prevention information 
consists of collections of guidance maneuvers displayed in one- dimensional ranges. These ranges define 
changes to the ownship’s velocity in either vertical speed, ground speed, or track angle. In the interest of 
space, this paper only describes changes to track angle in a 2-dimensional space; prevention bands for all the 
parameters in a 3-dimensional airspace are addressed in a related technical report. 5 

a We use the term tactical to mean a system which only uses near-term predictions of aircraft behavior without incorporating 
pilot or controller intent. 

b http : //research . nianet . org/f m- at-nia/ ACCoRD. 
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Figure 1. Compass Rose with 
Conflict Prevention Bands 
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A. Colors of Track Angles 


If an aircraft restricts its movement based on all aircraft within its surveillance range, then many relatively 
safe maneuvers will be unnecessarily avoided. Instead, only those aircraft that will cause near-term conflicts 
should be included in the computation of conflict prevention information. 

We follow the approach from Predictive AS AS 3 by introducing two parameters, T re( i and T arn b er , which 
divide the set of conflicts based on their nearness (in time) to a loss of separation. Predictive ASAS uses 
3 minutes for T re d and 5 minutes for T arn b e r, our analysis leaves these as parameters. Thus, the track-only 
guidance maneuvers may be partitioned into three sets of track angles, which are denoted: G green, G amber, 
Gred • These “colors” of sets mean that all of the track angles within these sets maintain a specific property 
as follows: the green maneuvers mean that if the ownship flies one of these paths, then there will be no loss 
of separation within time T arn b er ; the amber maneuvers mean that the if the ownship flies one of these paths, 
then there will be no loss of separation before T re d, but there will be a loss of separation before T arn b e r', 
finally, the red maneuvers mean that if the ownship flies one of these paths, then there will be a loss of 
separation before time T re d . 

Suppose we had a way to determine the set track angles that have a loss of separation within time T, 
denoted G<t • Then since T re d < T a mber, we may define our sets of track angles in terms of this new set: 

Gred = G<T red 

G amber = @<T arnber ~ Q<T red 

G green — | A < a < 360 } — G<T arnber 

This observation simplifies the analysis, because now we only need to analyze one set, G<t- 

B. Multiple Aircraft 

We observe that each aircraft’s contribution to the set G<t is independent of all other traffic; thus, the 
problem neatly divides into a series of aircraft pairs: the ownship and each traffic aircraft. If we use G<t to 
represent the set of track angles which cause a loss of separation within time T between traffic aircraft i and 
the ownship o, then the set of track angles for all traffic is then be formed by 

S<T= U S<T 

iGtraffic 

This observation simplifies the analysis again, because now we only need to find the track angles which 
cause a conflict between two aircraft, denoted by the set G<t- Before we examine the set G<t in detail, we 
introduce some mathematical modeling concepts. 

III. Modeling Considerations 

The position and velocity vectors of the ownship are denoted by s G and v G , respectively, and the position 
and velocity vectors of the traffic aircraft are denoted by s* and v*, respectively. The components of each 
position and velocity vector are scalar values, so they are represented without the bold-face font, for example 
s G = ( s ox ,s oy ). For notational convenience, for a given vector v, we use v 2 = v • v, = (v y , — v x ), and 
0 = (0, 0). 

As typical of state-based approaches, speeds are presumed to be ground-relative. The use of ground speed 
was chosen to correspond to position and velocity reports coming from Automated Dependent Surveillance 
(ADS-B) systems. The impact of differences between ground speed and air speed is left for future work. As 
a simplifying assumption, we regard the position and velocity vectors as accurate and without error. We 
also assume the aircraft are moving with respect to the ground, i.e., v G ^ 0 and ^ 0. However, relative 
velocity vectors can be 0, e.g., when both aircraft fly parallel to each other at the same ground speed. 

In a 2-dimensional airspace system, the separation criterion is specified as a minimum horizontal sep- 
aration D (in much of the airspace D is 5 nautical miles). It is convenient to develop the theory using a 
translated coordinate system where the traffic aircraft is at the center of the coordinate system and does 
not move, and the ownship is located at s 0 — s* and, until a maneuver is taken, the aircraft move relative to 
each other with velocity v G — v*. Henceforth, we denote the initial relative position of the aircraft by s, i.e., 

S — So Si. 


3 of 12 


American Institute of Aeronautics and Astronautics 


For example in figure 2, the blue (upper) dot represents the ownship 
with its velocity vector and the magenta vector (lower) is the velocity 
vector of the traffic. In the translated coordinate system, these vectors 
combine to form a single relative vector, also shown in blue in figure 2. The 
separation criterion defines a disc of radius D around the traffic aircraft. 

This disc is called the protected zone. 

In figure 2, the relative velocity vector (blue) defines a half-line that in- 
tersects the protected zone, meaning that in some future time the ownship 
will enter the protected zone around the traffic aircraft. If the intersection 
point occurs at a time less or equal than T the aircraft are in conflict. In this figure, the green vectors show 
possible resolution vectors. 

Formally, a 2-dimensional conflict occurs if there exists a time 0 < t < T when the aircraft will lose 
separation, i.e., the positions s G + t\ Q and s* + t\i are within a horizontal distance D of each other. In the 
relative coordinate system, we define 

Definition 1 (conflict?). 

conf lict?(s, v 0 , \i) = 30 < t <T : (s + t(v 0 ~ v*)) 2 < D 2 . (1) 

In this definition, we model future aircraft positions as a linear projection of the aircraft’s velocity from its 
current position. An aircraft’s accelerations — both positional and angular — are not modeled. The distance 
between two aircraft at time t is equal to | |s + £(v 0 — v$)| |. 

With the specification of a conflict in definition 1, we now develop a function to determine if a conflict 
exists. It is not difficult to prove that if v G ^ v* the minimum separation between two aircraft occurs at the 
time of closest approach r = — s • (v 0 — v*)/ (v 0 — v*) 2 . Since conflicts are predicted for times 0 < t < T, we 
have to consider the minimum distance between the aircraft during that interval of time. In particular, if 
r < 0 or if v G = v.j, then the minimum separation between the aircraft is achieved at time 0. Similarly, if 
r > T, then the minimum separation between the aircraft occurs at time T. Therefore, the aircraft minimum 
separation during the time interval [0, T\ is defined as follows. 

Definition 2 (Minimum distance function, fl). 



Figure 2. Translated Coordinate 
System 


fi(s,Vo,Vi) = 


if t < 0 or v G = 
otherwise. 


| |s + min(r, T)(v 0 — v* 

We can use this minimum distance function to completely characterize the predicate conflict?. 
Definition 3 (Conflict detection function, cd2d). 

cd2d(s, v 0 , V*) = ft(s ,v 0 ,v*) 2 < D 2 . 

Theorem 1 (Completeness of cd2d). cd2d(s, v 0 , v*) returns true if and only if conf lict?(s, v 0 , v^) holds. 


IV. Pair-wise Set of Track Angles 

We now investigate the set of ownship track angles that result in a loss of separation with aircraft 

i within time T. The minimum separation as function of the ownship’s track angle, denoted for a given 
relative position s, traffic’s velocity v*, and an ownship ground speed of ||v 0 || corresponds to 

n a = 0(s, ||v 0 ||Za,Vi) (2) 

where mZa = (m sina,ra cos a). It may appear that the sin and cos are reversed in this expression, but 
recall that a is a track angle defined as clockwise degrees from north, instead of the mathematical convention 
of counterclockwise from east. 

If we plot the function £2 a , then we will get a chart somewhat similar to figure 3. We observe that the 
points that cross the line labeled D (the horizontal separation minimum), are precisely the transition points 
between angles which should or should not be included in the set G°< T . By figure 3, only those angles where 
the minimum distance is beneath the line D are in this set. 
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Figure 3. Example of Minimum Separation as a Function of Ownship Track Angle 


Figure 3 implies that the function Q a is continuous and indeed it is; however the proof of this result is 
beyond the scope of this paper. The continuity of this function allows us to characterize intervals of track 
angles with a single angle. We observe this standard result from the mathematics of continuous functions. 

Theorem 2 (Intermediate Value). If f is continuous on the open interval ( xi,x u ) and /(#/) = 0, f(x u ) = 0 
and there are no other zeros between xi and x u , then f is either positive at every point in the interval or 
negative everywhere in the interval. 

By this theorem, all angles between the zeros of the distance function — D will all share the same conflict 
status. Since the transition points precisely correspond to the zeros of this function, we may select any angle 
between two consecutive transition points and the result of cd2d on that point determines the conflict status 
of all of the angles between the transition points. 

Our challenge to define set now involves finding all the transition points. Henceforth, we consider 
that the aircraft are initially separated, i.e., s 2 > D 2 . If this is not the case, then separation has already 
been lost; so, set Q is the whole range of track angles since no maneuver can avoid a preexisting loss of 
separation. 


V. Transition Points 


As described in the last section, our problem of analyzing the correctness of a conflict prevention bands 
algorithm comes down to finding all the transition track angles — the zeros in theorem 2. We note that an 
algorithm that finds a superset of transition points is still correct. However, for algorithmic efficiency we 
would like to ignore all non- transit ion points. 

Finding all the zeros of the function — D has shown to be difficult as it requires complex trigonometric 
reasoning. Rather that following a trigonometric approach, we use an algebraic method where we first find 
all the vectors such that 


= W 


tt a (s,v' 0 ,Vi ) 2 = D 2 , 


( 3 ) 

( 4 ) 


for given vectors s,v 0 ,v^. Equation (3) guarantees that has the same norm, i.e., ground speed, as v G . 
This ensures that v' Q is only a rotation of v 0 . Equation (4) ensures that is a zero of Q a — D. Then we can 
get the transition angles by track (v^) where track is the angle of V Q measured in clockwise degrees from 
north in the range [0, 360) . c 

Using theorem 1 and the definition of conflict?, equation (4) may be solved in two ways: (a) the 
half-line s + t(y 0 — v$) does not intersect the protected zone for any value of t > 0 or (b) it intersects the 
protected zone at a time t >T. The first case determines a set of transition points defined by vectors v' Q such 
that the relative velocity vector — v* yields a tangent trajectory to the protected zone. These transition 
points are called horizontal transition points. The second case determines a set of a set of transition points 
defined by vectors v' Q such that the relative vector — v* yields a trajectory that intersects the protected 
zone at exactly time T. These transition points are called lookahead time transition points. In the sections 
below, we discuss how to compute these two types of transition points. 

c We assume that track(O) = 0. 
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A. Horizontal Transition Points 

The horizontal transition points are those values of the owns hip’s track angle that produce a relative velocity 
vector that is tangent to the protected zone, as indicated by the green vectors in figure 2. The P-ASAS 
report 3 describes an interesting situation where a single aircraft pair produces two prohibited regions. We 
have formally verified that there are at most four different angles that define a trajectory tangent to the 
protected zone. 

Horizontal transition points are determined by vectors v' 0 such that the half- line s + t(v' 0 — v^), for t > 0, 
is tangent to the protected zone and v^ 2 = v 2 . In order to find such vectors V Q we proceed in several steps. 
First, we note that there at most two half-lines that are tangent to the protected zone. Then, for each one 
of these half-lines, we find a non-null vector u that lies in the half-line and points in the same direction. 
This vector will simplify the analysis provided it is only determined by the geometry of the encounter — the 
aircraft velocities are not involved. The vector u characterizes the half-line A;u, for k > 0. Therefore, the 
vectors V Q that determine the horizontal transition points are those that satisfy (3) and for some k > 0, 

ku = v' a - Vi. (5) 

Thus, we can find a V Q provided we find the tangent vector u and k. Finding these two quantities is the 
subject of the next two sections. The third section collects these results into a function. 


1. Finding Tangents 

Since s 2 > D 2 , we consider two cases: (a) s 2 = D 2 and (b) s 2 > D 2 . In the first case, any vector that is 
perpendicular to s lies in a half-line that is tangent to the protected zone. Therefore, we define the vectors 
u e = es^, for e = ±1. In the second case, for each one the two half-lines, we define a point on the protected 
zone that is tangent on the line from s. Since there are at most two half-lines that are tangent to the 
protected zone, there are at most two such points, which we call Q e . 


Definition 4 (Q € ). 


for e zb 1 . 


_ , x D 2 
Q £ (s)= -js+e -j 


D 2 


Then, we define the vectors u € = Q e (s) — s. These two vectors completely characterize the two half-lines 
that are tangent to the protected zone when s 2 > D 2 . 

We combine the two cases into the function tangent_line to compute the tangent vectors. 


Definition 5 (tangent _line). 

tangent_line(s, e) = 


IF s 2 = D 2 THEN 
es 1 
ELSE 

Q c (s) -s 
END IF 


Lemma 1 (tangent line). The relative velocity vector v yields a trajectory that is tangent to the protected 
zone if and only if v = k tangent_line(s, e) for some k > 0. 


2. Magnitude of the Tangents 


From lemma 1, we know that for any k > 0, the relative velocity vector k tangent_line(s, e) yields a 
trajectory that is tangent to the protected zone. Now we must find a k > 0 such that v 12 = v 2 when 
k tangent _line(s, e) = — v*. Using equation (3), equation (5) can be transformed into a quadratic 

equation in k 


(fcu + Vj) 2 = v 2 , 


(6) 


which has at most two solutions for k. The function trk_only_line solves this quadratic equation. 
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Definition 6 (trk only line). 

trk_only_line(u, v 0 , v*, e) = LET a = u 2 , 

6 = 2(u-Vi), 
c = v 2 — v 2 

c v z v o> 

A = 6 2 - 4 ac IN 

IF A > 0 THEN LET k = IN + Vi ) 

2 a 

ELSE ( 0 , 0 ) 

The function trk_only_line returns the pair (0, 0) when there are no solutions for k and v^. 

Lemma 2 (Completeness of trk_only_line). A number k and a non-null vector V Q satisfy equations (3) 
and (5) if and only if (h,v f 0 ) = trk_only_line(u, v G , v$, e). 

3. Transition Points from Tangents 

Using lemmas 1 and 2 , we have that the horizontal transition points are exactly defined by the vectors 
that satisfy 

(k,v' 0 ) = trk_only_line(tangent_line(s,ei), v 0 ,Vi,e 2 ), ( 7 ) 

for k > 0 , £1 = d=l, 62 = ±1. We observe that this equation uses e\ and 62 , each may be either —1 or + 1 ; 
thus, there are four possible solutions to this equation. 

Combining these results, we define 

Definition 7 (trk_line). 

trk_line(s, v 0 , 61, 62) = LET (k,V Q ) = trk_only_line(tangent_line(s, 61), v G , v*, 62) IN 

IF k > 0 THEN V 0 
ELSE 0 

The function trk_line returns the vector 0 when there are no solutions for v^. 

Theorem 3 (Completeness of trk line). A non-null vector V 0 satisfy equations (3) and the half-line 
s + ^(Vo- Vi), fort > 0, is tangent to the protected zone if and only if v' Q = trk_line(s, v G , Vi, 61, 62) for 
some €\ = ± 1 , 62 = ± 1 . 

B. Lookahead Time Transition Points 

We now consider ways to use the lookahead time to ignore those aircraft 
that are “too far” away. First, we find the velocity vectors where the 
ownship will touch the protected zone at precisely the lookahead time, as 
illustrated by figure 4. 

Lookahead time transition points are determined by vectors that 
satisfy three equations: equation (3) along with 

(s + T(w' 0 -y i )) 2 = D\ ( 8 ) 

(s + T(v ' 0 - Vj)) ■ K - < 0 . ( 9 ) 

Equation (3) states that v' 0 has the same norm as v 0 , equation (8) states 
that the ownship is at the border of the protected zone at time T, and 
equation (9) states that immediately after time T the ownship enters the 
protected zone. 

Solutions to equations (3) and (8) correspond to the intersection of two circles, which may have zero, 
one, two, or infinite solutions. We first consider the special case of infinite solutions. 


t ^ 



Figure 4. Lookahead Time Tran- 
sition Points 
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1. Special Case 


First we consider the case where there is an infinite number of solutions. For the remainder of this section 
we will assume s,v 0 , v* satisfy trk_special_case?. 

Definition 8 (trk_special_case?). 

D 2 

trk_special_case?(s, v G , v*) = s = TV* and v 2 = -=r. (10) 

Within this special case and given equation (3), then equation (8) is satisfied. Next, we have formally proven 
the following result 


Lemma 3 (Special Case). Equation (9) holds if and only if -iconf lict?(s, v^, v*). 
By lemma 3, we no longer need to solve (9) but only a restricted instance of it 


( s + T {\' 0 — Vj)) • (v^ — Vj) = 0, 


( 11 ) 


which has at most two solutions. To solve equation (11), we transform it into the equivalent form: 


D 2 

V - — = 0 

v o JI2 


( 12 ) 


In our mathematical development, we have defined functions to solve these kinds of equations. In particular, 
we have found, 

Lemma 4 (Completeness of trk_only_dot). Let a, b' be non-null vectors and e > 0. 

a • (b ; — c) = e and b 2 = b /2 if and only if b' = trk_only_dot(a, b, c, e, c) 


where, 


trk_only_dot(a, b, c, e, e) = LET (fc, b') = trk_only_line(a J \ b, c d — -a, e) IN 

a 

b', 

provided a ^ 0, e > 0, and e — ±1. 

We can cast equation (12) in the form of lemma 4; so, the lookahead transitions points for the special case 
are exactly defined by the vectors v' Q = trk_only_dot(v^, v G , 0, e) for e = ±1. 

2. General Case 

Now we consider the case of vectors s, v 0 ,Vi that do not satisfy trk_special_case?(s, v G , v*). In this 
case, there are at most two solutions to equations (3) and (8). To find these solutions, we note that when 
equation (3) holds, equation (8) can be written as 

W • « - Vi) = e, (13) 

where w = s - Tv, and e = d> 2 -s 2 -g)(vg-v?) 

As in the special case, equation (13) can be resolved using the function trk_only_dot. Using lemma 4, the 
lookahead transition points for the general case are exactly defined by the vectors that satisfy equation (9) 
and 


v ’ 0 = trk_only_dot(w,v 0 ,Vi,e,e), 


( 14 ) 


for e = dzl. 

Combining this result with the special case we define, 
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Definition 9 (trk circle). 


trk_circle(s, v G , v*, e) = 


IF trk_special_case?(s, v 0 , THEN 

D 2 

trk_only_dot(vi, v G , 0, ^ ,e) 

ELSE 


LET Vq = trk_only_dot(s — Tv*, v 0 , Vi, 
IF (s + T(v' 0 - Vi)) • {v' 0 - Vi) < 0 THEN 


(P 2 -s 2 -r 2 )(v 2 0 -v 2 ) 
2 T 


,6) IN 


ELSE 

0 

ENDIF 
END IF 


The function trk_circle returns the vector 0 when there are no solutions for V Q . 

Theorem 4 (Completeness of trk_circle). 

• Case trk_special_case?(s, v G , Vi): A non-null vector v' Q satisfy equations (3), (8), and (12) if and 
only ifv' Q = trk_circle(s, v G , Vi, e) for some e = ±1. 

• Case -itrk_special_case?(s, v 0 , Vi): A non-null vector V 0 satisfy equations (3), (8), and (9) if and 
only ifv f 0 = trk_circle(s, v G , v*, e) for some e = ±1. 


VI. Track Angle Prevention Bands Algorithm 

In this section, we provide the mathematical basis that guarantee the correctness of the track angle 
prevention bands algorithm. First, we define a set of transition vectors and a set transition angles as follows: 

V = {v^ ^ 0 | (v^ = trk_line(s, v 0 ,Vi,6i,e 2 ) for some ei = ±l,e 2 = ± 1 ) or 

(v' 0 = trk_circle(s, v G , Vi, e) for some e = ±1)} 

A = {a | a = track(v^) for some vj, E V}. 

An open interval (qi, q 2 ) is a track angle band if it does not contain transition points, i.e., 0 < Qi < q 2 < 360 
and for all (3 G A: 0 £ (qi, a 2 ). We have formally proven the basic correctness result for track angle conflict 
prevention information, theorem 5. 

Theorem 5 (Completeness of Track Angle Bands). Let (ai,a 2 ) be a track angle band and let a £ (a i,a 2 ). 

• // cd2d(s, | |v 0 ||Za, Vi) returns true, then for all 7 £ (ai, a 2 ) : conf lict?(s, | |v 0 ||Z7, Vi), 

• // cd2d(s, | |v 0 ||Za, Vi) returns false, then for all 7 £ (a\ ,a 2 ) : -iconf lict?(s, 1 1 v 0 | |Z"y, Vi). 

The proof of theorem 5 involves the fact that the function is continuous, the Intermediate Value 
theorem (theorem 2), theorems 1, 3, and 4, and the fact that the set A contains all the transition track 
angles. 

Based on theorem 5, we propose the following algorithm that computes Q The algorithm first con- 
structs a list that contains all the elements in A. Then, the elements 0 and 360 are added and the list is 
sorted. Next, the list is pair-wise iterated to get each band and the cd2d algorithm is used on the mid-point 
of the band to determine if the band should be in the set Q°^p. In this algorithm, we are not making any 
special attempt to handle implementation concerns such as floating point round-off errors. 
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Definition 10 (Pair-wise Algorithm for Track Angle Prevention Bands). 


trk_bands(s, v G , v*) = 

angle[ 0] : = track(trk_line(s, v G , v*, —1, — 1)) 
angle[ 1] : = track(trk_line(s, v 0 , v$, —1, +1)) 
angle[ 2] : = track(trk_line(s, v 0 , v*, -hi, — 1)) 
angle[ 3] : = track(trk_line(s, v 0 , Vj, -hi, -fl)) 

angle[ 4] : = track(trk_circle(s, v G , v*, — 1)) ; 
angle[ 5] : = track(trk_circle(s, v G , v*, +1)) ; 


angle[6\:= 0; 
angle[ 7] : = 360; 


sort [angle ) ; 

Q°jr := 0 ; 

FOR EACH oti,Qii+i IN angle 
LET a = (a* + ai_|_i)/2 IN 
IF cd2d(s, ||v 0 ||Za,Vi) THEN 

@<3? := @<T ^ > 

END IF 

RETURN 

For efficiency, we could remove from the list angle the points where the functions trk_line and 
trk_circle return the vector 0 because this vector does not determine a transition point. However, since 
track(O) is assumed to be 0, the proposed algorithm is correct. 

VII. Conclusions 

The mathematics underlying conflict prevention systems is more subtle than expected. Instead of a 
trigonometric analysis that yields fourth-order polynomial equations, a vector-based approach is developed. 
We have found a clean decomposition of the problem. First the problem is divided along the dimensions 
of ground speed and track angle. Next, the problem is divided into near-term and intermediate-term time 
horizons. Then the problem may be reduced from an N-aircraft problem, to a pair-wise problem. Since the 
maximum number of transition points is fixed, this pair-wise division of the problem results in an algorithm 
that scales linearly with the number of traffic aircraft. 

In this paper, we have focused on a 2-dimensional prevention bands algorithm for track angle. Techniques 
in this paper have been used to address the ground speed dimensions of conflict prevention information too. 
The major distinction between the mathematical development for these dimensions and those presented 
in this paper is that different transition points are used. For completeness, a 2-dimensional ground speed 
prevention band algorithm is presented in the appendix. We have formally verified the correctness of the 
mathematical basis of these algorithms. Due to safety concerns associated with incorrect information from 
a conflict prevention system, we believe this further step of a formal verification is justified. 

An open question is should a 2-dimensional algorithm be used or a 3-dimensional one. This question 
cannot be answered formally, but rather is based on pilot acceptance. Would a pilot, looking at a horizontal 
display, expect that separation must occur only in the horizontal dimension? If so, then a 2- dimensional 
algorithm is preferred. In any case, an extension of this work to 3-dimensional algorithms is work in progress. 5 
Extending this analysis is not straightforward. First, we need a new definition of the minimum distance 
function Q that characterizes 3-dimensional conflicts. Since in a 3-dimensional space the protected zone is a 
cylinder rather than a sphere a distance function based on 3-dimensional Euclidean distance does not seem 
to be appropriate. Furthermore, we need to find the new transition points added by the vertical dimension 
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and to prove that we have found all of them. These issues add considerable complexity to the formal proofs. 

Beyond these developments, we also intend to use the mathematics developed in this paper as a foundation 
for evaluating the traffic complexity and to develop techniques for down- selecting solutions from conflict 
detection and resolution algorithms, which produce multiple conflict resolutions. 
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VIII. Appendix 


This appendix defines algorithms to compute 2-dimensional ground speed conflict prevention bands. The 
mathematical development that led to these algorithms is presented in the related technical report. 5 

Definition 11 (det). 

det(v, u) = v x u y - v y u x 

Definition 12 (gs_line). 


gs_line(s,v 0 , Vj,e) = 

LET v = tangent_line(s, e) IN 
IF det(v G , v) ± 0 THEN 
det(Vj, v G ) 


LET k - 


det(v G , v) ’ 


A= d,t , (v ‘' v ! i» 

det(v 0 , v) 

IF A > 0 AND k > 0 THEN 
A v 0 


ELSE 

0 

END IF 
ELSE 
0 

END IF 
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Definition 13 (gs_circle). 


gs_circle(s, v G , v*,e) = 

LET w = s — Tvi, 
a = T 2 vl 
b = 2T (w • v G ), 
c = w 2 - jD 2 IN 
IF discr(a, 6, c) > 0 THEN 
LET A = root(a, 6, c, e) IN 
IF A > 0 THEN 

LET v' = Av 0 - Vi IN 
IF (s + Tv') • v' < 0 THEN 
A v 0 
ELSE 
0 

ENDIF 

ELSE 

0 

ENDIF 

ELSE 

0 

ENDIF 


Definition 14 (gs bands). 


gs_bands(s, v 0 , = 

gs[ 0] := ||gs_line(s,v 0 ,v*,-l)||; 
gs[l] := ||gs_line(s,v 0 ,Vi,+l)||; 
gs[2\ := ||gs_circle(s,v 0 ,Vi,-l)|| 
#s[3] := ||gs_circle(s ? v 0 ,Vi,+l)|| 
gs[4 :] := min_ground_speed; 
gs[5] := max_ground_speed; 
sort (gs); 

Q% := 0; 

FOR EACH gs{,gsi+i IN gs 


LET A = 


gsi + gsi + 1 


2||v 0 || ’ 

v'o = (A Vox, \v oy ) IN 
IF cd2d(s, Vq, Vj) THEN 

:= G<-T ^ (d s it9 s i+ 1 )> 

ENDIF 


RETURN Q 0 ^-, 
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